MayFly Tool Keeps Dev Secrets in RAM Only, Built With Go Standard Library

A team built MayFly, a secrets management tool, during the Raptor Zero Dependency Hackathon with a strict 72-hour, no-external-library constraint using only Go's standard library. The tool addresses a widespread vulnerability where plaintext API keys stored in .env files on disk are silently stolen by malicious npm or pip packages during routine installations. Unlike sandboxing approaches, MayFly stores secrets in an encrypted vault and decrypts them directly into volatile memory at runtime, so keys never touch the hard drive in plaintext. When a developer runs a command through MayFly, it captures a master passphrase, decrypts only the relevant project secrets into RAM, and injects them into the child process's environment. The project builds on the team's earlier tool L.I.O.N., a Rust-based sandbox, which highlighted that protecting disk-resident plaintext keys is fundamentally insufficient.